What you need to know about the Red Flags Rule

Lawyers must comply with the Federal Trade Commission's so-called Red Flags Rule starting Nov. 1. The rule, a part of the Fair and Accurate Credit Transactions Act requires creditors, including attorneys, to detect early signs of identity theft. The FTC can seek monetary civil penalties and injunctive relief for violations of the rule.

The New Jersey State Bar Association prepared this document to help guide you through the new rule. If you have further questions, contact the Member Services department at 732-249-5000.

Q: What must a law firm do to comply with the rule?

A: "Under the Red Flags Rules, financial institutions and creditors must develop a written program that identifies and detects the relevant warning signs - or "red flags" - of identity theft. These may include, for example, unusual account activity, fraud alerts on a consumer report, or attempted use of suspicious account application documents. The program must also describe appropriate responses that would prevent and mitigate the crime and detail a plan to update the program. The program must be managed by the Board of Directors or senior employees of the financial institution or creditor, include appropriate staff training, and provide for oversight of any service providers," according to the FTC.

Q: What other details has the FTC provided about compliance?

A: It also states on its website:

"The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft and enable a financial institution or creditor to:

Identify relevant patterns, practices, and specific forms of activity that are "red flags" signaling possible identity theft and incorporate those red flags into the Program;

Detect red flags that have been incorporated into the Program;

Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and

Ensure the Program is updated periodically to reflect changes in risks from identity theft."

Q: Where can I find out more about the rule and its requirements?

A: For a checklist on compliance, click here to see a sample template.

To find a business how-to guide, click here.

For more general information, visit the FTC's website for extensive information about the rule.

Q: What position has the New Jersey State Bar Association taken on this rule?

A: The New Jersey State Bar Association added its voice to the chorus of bar groups around the country opposing the rule. It sent letters to the head of the FTC and members of New Jersey's Congressional delegation. The association's board of trustees protested the measure in a resolution adopted this summer. The American Bar Association has spearheaded the opposition.

Q: Why does the State Bar oppose it?

A: Lawyers say the rule should not apply to them because they don't engage in the kind of commercial transactions the law seeks to address.

"This rule is an unwarranted burden," said State Bar President Allen A. Etish, president of the state bar. "It is not likely to stem identity theft; however, it could very well damage the relationship attorneys have with their clients."

Q: What does the FTC say about the rule?

A: The rule is meant to help deter fraud, said Naomi Lefkovitz, an attorney with the federal agency's Division of Privacy and Identity Protection.

"The goal is to prevent identity thieves from getting goods or services in somebody else's name," she said. While the agency doesn't view all attorneys as fitting into the creditor category, it does feel the traditional payment arrangements in which lawyers bill after a service is provided fall under that definition.

Q: Given all this opposition, what else is happening with the rule now?

A: The American Bar Association has been a vocal opponent of the rule. It has filed a federal lawsuit, which is pending. It is also pursuing legislative solutions. In late October, the House passed H.R. 3763 regarding the rule. ABA President Carolyn Lamm said, "Today's vote was an important recognition that the Federal Trade Commission's interpretation of the Red Flags Rule over-reaches and its application to lawyers is unnecessary. But more work remains. Today's legislative solution is incomplete and would burden large segments of the public and the FTC with unwarranted bureaucratic procedures."